The platform allows users to describe workflows in plain language, with AI agents generating the underlying applications. Cloudflare says the system is compatible with multiple AI models, allowing organizations to choose different models depending on the task while also monitoring AI usage and controlling inference costs.
Principal engineer Kenton Varda said security was a primary design goal. "This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild—the AI cannot introduce a significant security bug," Varda wrote on X. "We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night."
Cloudflare's security model runs each application instance inside its own sandbox using its Dynamic Workers technology. Rather than relying on traditional software containers, the platform launches isolated V8 JavaScript execution environments that the company says start in milliseconds while using only a few megabytes of memory.
According to Cloudflare, AI agents begin with no permissions to access company resources and must explicitly request access through the platform. Server-side code operates with outbound internet access disabled by default, while client-side code runs inside a sandboxed browser environment unless users grant additional permissions.
The company also said administrators can track AI inference spending, establish budgets, and apply rate limits across their organizations. In addition, Cloudflare has shifted many workflows toward deterministic skill files that reduce the need for repeated AI inference during routine tasks.
Cloudflare said lessons learned from deploying the platform internally shaped the product's current design. Chief Information Officer Sam Rhea said the company initially gave non-engineering employees AI coding tools similar to those used by software developers, which led to unnecessary application creation. "If you give everyone a harness workspace that is great at writing code, you'll wind up with way more code than you need," Rhea wrote.
To improve code quality, Cloudflare created the Cloudflare Engineering Codex, an internal standards guide used by both engineers and AI systems during code reviews. Systems engineer Timo Reimann said the company's AI reviewer flagged nearly 250,000 deviations from engineering standards and blocked 16,000 code merges over the past four months.
Although Cloudflare OS is now open source, the company noted that deploying its backend requires a Workers Paid plan. After a GitHub user reported discovering the paid requirement partway through deployment, Cloudflare updated the installation process to notify users of the subscription requirement before deployment begins and responded to the issue on GitHub.
This analysis is based on reporting from ars TECHNICA.
Image courtesy of Cloudflare.
This article was generated with AI assistance and reviewed for accuracy and quality.
